Remote Pro

Secure Single Use QR Codes

Secure Single Use QR Codes

Secure single use QR codes extend the standard QR code contactless operation. Each code is signed with a password, making it difficult to forge, and can only be used once on a given computer. Use cases include:

  • Theme parks and attractions issuing single-use photo coupons
  • Paid photo booths where users complete online payment (e.g. via PayPal) and receive a QR code by email or text

 

Enabling Secure Single Use QR Codes

Enable Scan QR codes for commands and Scan QR codes for strings in Photobooth Settings for the event. Then open File -> Single use QR codes and check Only accept single use QR codes to ignore all other QR codes.

!(zoom)rp-secure-qr

 

 

Generating QR Codes

Open File -> Single use QR codes. Configure the following:

  • QR Code quality — higher quality makes codes more resilient (useful if placing a logo over part of the code)
  • Base URL — any URL; opened in a browser if scanned with a phone
  • Command 1 — touchscreen command to run when scanned (e.g. photoStart)
  • Auto email — email address to send photos to automatically (for testing)
  • Auto text — phone number to send a text to automatically
  • Password — makes the QR code more secure; scanned codes are rejected if the password does not match
  • Computer name — limits the code to a specific computer (leave empty to disable)
  • Expiry — click Date/time… to set when the code expires

Save the QR code as a PNG using Save as PNG…

 

Error Feedback

Custom PNG screens can be provided for error states:

  • qr_missing_parameters.png — missing auth or j parameters
  • qr_not_authorized.png — signature mismatch or computer name mismatch
  • qr_invalid.png — JSON cannot be decoded
  • qr_used.png — QR code already used on this computer
  • qr_expired.png — QR code has expired

 

Technical Details

The QR code URL contains two parameters: a JSON string (j) and a SHA1 signature (auth). The JSON can include strings (s1–@s10@), commands (c1–@c10@), email, expiry timestamp, and an optional computer id field.

The signature is the SHA1 hash of the JSON string concatenated with the password.

Example PHP Script

The PHP snippet below generates a secure QR code that starts a photo session and auto-emails the output, valid for 5 minutes:

$json['c1'] = "photoStart";
$json['autoemail'] = "[email protected]";
$json['expiry'] = time() + 300;
$jsonStr = json_encode($json);
$auth = sha1($jsonStr . "<auth_password>");
$url = "https://breezesys.com?auth=$auth&j=" . urlencode($jsonStr);